Security Bulletin
Summary
The version 4.x release of IBM Rational Quality Manager is shipped with an IBM Java that is based on the Oracle Java. Oracle has released October 2012 and February 2013 critical patch updates (CPU) which contain security vulnerability fixes and the IBM Java is affected.
Vulnerability Details
Subscribe to My Notifications to be notified of important product support alerts like this.
|
CVE ID: CVE-2012-5081
Description: An unspecified vulnerability in Oracle Java Runtime Environment related to JSSE could allow a remote attacker to cause a denial of service using unknown attack vectors.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/79435 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVE ID: CVE-2013-0437
Description: Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81753 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVE ID: CVE-2013-1478
Description: Unspecified vulnerability in the JRE component allows remote attackers to affect confidentiality, integrity, and availability, related to 2D.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81754 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVE ID: CVE-2013-0440
Description: Unspecified vulnerability in the JRE component allows remote attackers to affect availability via vectors related to JSSE
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81799 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVE ID: CVE-2013-0443
Description: Unspecified vulnerability in the JRE component allows remote attackers to affect integrity via unknown vectors related to Networking
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/81801 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Affected Products and Versions
Rational Quality Manager 4.0.2 and earlier.
Remediation/Fixes
Upgrade to Rational Quality Manager 4.0.3 or later includes an updated IBM Java version to address the security issues.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
IBM Security Alerts: Oracle October 2012, Oracle February 1 2013, Oracle February 19 2013
Oracle Critical Patch Update Advisory – October 2012, February 2013
Acknowledgement
None
Change History
*08 August 2017: xforce links updated
* 26 July 2013: CVE0169 is not covered
* 07 June 2013: Original copy published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Product Synonym
Rational Quality Manager
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21638108